Inherit from AuthenticationStateProvider or CslaAuthenticationStateProvide

[ecaldentey]

Hello Everyone
I am implementing authentication and authorization with JWT and as part of the process I need to create a class that implements the abstract class AuthenticationStateProvider. However, Csla has its own implementation, which is CslaAuthenticationStateProvider. So what is the suggestion: to inherit from AuthenticationStateProvider or CslaAuthenticationStateProvider?

If the answer is CslaAuthenticationStateProvider, what are the benefits?

Thanks in advance

[rockfordlhotka]

Is this on the server or wasm? I assume wasm, because we removed any custom authn stuff from Csla.Blazor on the server.

On the wasm client, there is (or was) no default AuthenticationStateProvider provided generically, and so CSLA includes one with a very simple implementation - just so people can have a simple place to store the user identity.

https://github.com/MarimerLLC/csla/blob/main/Source/Csla.Blazor.WebAssembly/Authentication/CslaAuthenticationStateProvider.cs

It doesn't do anything special, and all CSLA needs is that there actually be an authn state provider that maintains the user principal.

CSLA uses a try pattern to add the CslaAuthenticationStateProvider service, so if you've added a different one already, it won't override what you've configured.

csla/Source/Csla.Blazor.WebAssembly/Configuration/ConfigurationExtensions.cs

Line 47 in 0b5048e

config.Services.TryAddScoped(typeof(AuthenticationStateProvider), typeof(Blazor.Authentication.CslaAuthenticationStateProvider));

In summary, I'd recommend subclassing AuthenticationStateProvider directly.

[rockfordlhotka]

I don't know why the SignInAsync didn't work then, that seems odd, as that should cause all server-side pages (static or interactive) to be authenticated.

To get the principal to any wasm-interactive pages - that's what the CSLA state management feature can do, as demonstrated by the code in ProjectTracker.

So are you seeing that the server-side pages aren't authenticated? That seems like something is wrong with the aspnetcore authn/authz configuration in your project.

Or is it wasm client pages that don't have access to the user principal? That would be an issue (probably) with the configuration of the CSLA state manager feature.

[ecaldentey]

Hi Rocky,

When you created the Blazor project for ProjectTracker, what configuration did you select?
Template: Blazor Web App
Authentication type: None
Configure for Https: Yes
Interactive render mode: Auto or WebAssembly?
Interactivity location: Per page/component?

I want to replicate your exact configuration to see what might be going wrong.

Thank you very much.

[rockfordlhotka]

Blazor Web App, authz none, https yes, render mode auto, per page render mode

[ecaldentey]

Hi Rocky,

While searching for the origin of the issue why I can't save the session, I encounter two things.

If I include the instruction in my login page:
@rendermode InteractiveServer

My Csla classes stop working, meaning the following instruction cannot retrieve the Fetch method from the server side:

return await _dataPortal.FetchAsync(new FilterCriteria(userDto, DbActionTypes.Select, selectDbType, customFilters));
It doesn't find:

[Fetch]
private void Fetch(FilterCriteria filterCriteria, [Inject] ILanguageService serviceLanguage, [Inject] IUserDal dal, [Inject] IChildDataPortal listUserSystems)
{
UserDto userDto = new UserDto();

Csla.Data.DataMapper.Map(filterCriteria, userDto, true);
// ....

If I remove that instruction, Csla works perfectly again, and I can retrieve my Business Class. However, in this case, when I try to save the session information in an HttpContext or a ProtectedSessionStorage:

private async Task HandleLogin()
{
ErrorMessage = String.Empty;

var loginResponse = await userLoginManager.LoginUserAsync(userDto);

if (loginResponse.LoginStatus)
{
    await SessionStorage.SetAsync("SessionID", userDto.Username);
    // ...

I get the following error:

An unhandled exception occurred while processing the request.
InvalidOperationException: JavaScript interop calls cannot be issued at this time. This is because the component is being statically rendered. When prerendering is enabled, JavaScript interop calls can only be performed during the OnAfterRenderAsync lifecycle method.
Microsoft.AspNetCore.Components.Server.Circuits.RemoteJSRuntime.BeginInvokeJS(long asyncHandle, string identifier, string argsJson, JSCallResultType resultType, long targetInstanceId)
Am I missing any parameters to make Csla work when defining the page to render on the server side?

Regards

[rockfordlhotka]

If I include the instruction in my login page:
@rendermode InteractiveServer

The login page must be server-static because it interacts with HttpContext, and that is only safe to do in a server-static page.

[michaelcsikos]

Hi @ecaldentey and @rockfordlhotka

I've used the Login.razor as the basis to migrate from the old method of logging in with a cshtml. The SignInAsync is working, however NavigationManager doesn't work at all without @rendermode InteractiveServer. It throws:

Exception of type 'Microsoft.AspNetCore.Components.NavigationException' was thrown.

I can't figure out why it works in the ProjectTracker example. If I inject a NavigationManager onto any SSR page, it doesn't work.

[rockfordlhotka]

I have no idea.

[michaelcsikos]

This is a known issue: dotnet/aspnetcore#53996

Using an extension method HttpContext.RedirectTo(...), with [CascadingParameter] public HttpContext? HttpContext { get; set; } and adding method="post" Enhance to the EditForm is a workaround.

public static class BlazorSsrRedirectManagerExtensions
{
    public static void RedirectTo(this HttpContext httpContext, string redirectionUrl)
    {
        ArgumentNullException.ThrowIfNull(httpContext);

        httpContext.Response.Headers.Append("blazor-enhanced-nav-redirect-location", redirectionUrl);
        httpContext.Response.StatusCode = 200;
    }
}